Evidence-Based Compliance: Controls That Leave a Trail
At some point in every inspection, review and due diligence the same question lands: show that this control worked in March. A policy answers a different question. This article is about designing controls so that the proof exists before anyone asks.
Sixty seconds that set the tone
Picture a call in late August. The acquirer’s counsel shares her screen, opens your AML policy and says: “Page 12 states that every new counterparty is screened. Show me the screening record for a counterparty you onboarded in March.” The next minute shapes the rest of the review.
Evidence has an anatomy: who acted, what they checked, when, on what basis (which list, which version, which threshold) and where the record sits. A screenshot assembled three weeks later survives few of those elements.
KSeF as a design pattern
Poland is running a live example of an obligation that produces its own evidence. KSeF, the national e-invoicing system, has been mandatory since 1 February 2026 for taxpayers whose 2024 gross sales exceeded PLN 200 million and since 1 April 2026 for everyone else, based on the Act of 5 August 2025 (Journal of Laws 2025, item 1203). Transitional simplifications run until the end of 2026, including invoices issued from cash registers and simplified invoices where monthly sales stay within PLN 10,000.
For a compliance officer the mechanics matter more than the tax angle: the invoice passes through the state system as part of being issued, so the transaction record exists the moment the work happens. Nobody reconstructs March invoices in April. The same logic transfers to your own controls: the record should appear as a by-product of doing the work, generated by the system where the work takes place.
The three-question test
Take any control from your register and ask three questions. First: if it fired last month, where is the record now? Second: does the record show who decided, what they looked at and on what basis? Third: can you produce it within an hour, without asking the person who did the work? Every “no” marks a control you would struggle to defend in a review.
The test changes how you prepare for reviews and due diligence. Instead of writing narratives for the data room, you index existing records: control, record location, owner, retrieval time. Gaps surface months earlier, while there is still time to close them.
What we recommend now
For the next two weeks:
- Pick five controls from your register, the ones a reviewer would test first, and run each through the three-question test.
- For the controls that fail, move record-keeping into the tool where the work happens: ticket fields, workflow logs, system reports capturing who, what, when and on what basis.
- Agree one rule with the team: a review collects existing records, and nobody reconstructs evidence after the fact.
- If KSeF covers your company, write the rollout up as an internal case study and name two other obligations where evidence could be produced just as systemically.
- Start an evidence index for the next review or due diligence: control, record location, owner, time to produce.
Sources: ksef.podatki.gov.pl: legal basis and deadlines